CVE-2026-102721
CVE-2026-102721
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.
#advisory
共收录 23212 条相关情报。
← 返回所有主题CVE-2026-102720
CVE-2026-102720
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the
CVE-2026-102719
CVE-2026-102719
Predictable DTLS HelloVerifyRequest Cookie in NetX Secure
CVE-2026-102718
CVE-2026-102718
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains
CVE-2026-102716
CVE-2026-102716
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Sessio
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
CVE-2026-102677
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 unti
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
CVE-2026-102715
Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. Th
CVE-2026-102714
CVE-2026-102714
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.
CVE-2026-102713
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf
CVE-2026-102712
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-lis
CVE-2026-102710
CVE-2026-102710
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dis
CVE-2026-102709
CVE-2026-102709
Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows
CVE-2026-102762
CVE-2026-102762
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet,
CVE-2026-102761
CVE-2026-102761
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained
CVE-2026-102760
CVE-2026-102760
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has b
CVE-2026-102759
CVE-2026-102759
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secu
CVE-2026-102758
CVE-2026-102758
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data
CVE-2026-102757
CVE-2026-102757
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,
Marmite through 0.4.2 Unauthenticated API Access via Development Server
CVE-2026-102811
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmi
Marmite through 0.4.2 Path Traversal via Development Server
CVE-2026-102810
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows u